@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
inc 183 lines 5.34 KB
Raw
1 /* SPDX-License-Identifier: GPL-2.0-or-later */
2
3 #include <stdint.h>
4 #include <stdbool.h>
5 #include <stdlib.h>
6 #include <string.h>
7 #include <stdio.h>
8
9 static bool test_SB_SR(uint8_t *o, const uint8_t *i);
10 static bool test_MC(uint8_t *o, const uint8_t *i);
11 static bool test_SB_SR_MC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k);
12
13 static bool test_ISB_ISR(uint8_t *o, const uint8_t *i);
14 static bool test_IMC(uint8_t *o, const uint8_t *i);
15 static bool test_ISB_ISR_AK_IMC(uint8_t *o, const uint8_t *i, const uint8_t *k);
16 static bool test_ISB_ISR_IMC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k);
17
18 /*
19 * From https://doi.org/10.6028/NIST.FIPS.197-upd1,
20 * Appendix B -- Cipher Example
21 *
22 * Note that the formatting of the 4x4 matrices in the document is
23 * column-major, whereas C is row-major. Therefore to get the bytes
24 * in the same order as the text, the matrices are transposed.
25 *
26 * Note that we are not going to test SubBytes or ShiftRows separately,
27 * so the "After SubBytes" column is omitted, using only the combined
28 * result "After ShiftRows" column.
29 */
30
31 /* Ease the inline assembly by aligning everything. */
32 typedef struct {
33 uint8_t b[16] __attribute__((aligned(16)));
34 } State;
35
36 typedef struct {
37 State start, after_sr, after_mc, round_key;
38 } Round;
39
40 static const Round rounds[] = {
41 /* Round 1 */
42 { { { 0x19, 0x3d, 0xe3, 0xbe, /* start */
43 0xa0, 0xf4, 0xe2, 0x2b,
44 0x9a, 0xc6, 0x8d, 0x2a,
45 0xe9, 0xf8, 0x48, 0x08, } },
46
47 { { 0xd4, 0xbf, 0x5d, 0x30, /* after shiftrows */
48 0xe0, 0xb4, 0x52, 0xae,
49 0xb8, 0x41, 0x11, 0xf1,
50 0x1e, 0x27, 0x98, 0xe5, } },
51
52 { { 0x04, 0x66, 0x81, 0xe5, /* after mixcolumns */
53 0xe0, 0xcb, 0x19, 0x9a,
54 0x48, 0xf8, 0xd3, 0x7a,
55 0x28, 0x06, 0x26, 0x4c, } },
56
57 { { 0xa0, 0xfa, 0xfe, 0x17, /* round key */
58 0x88, 0x54, 0x2c, 0xb1,
59 0x23, 0xa3, 0x39, 0x39,
60 0x2a, 0x6c, 0x76, 0x05, } } },
61
62 /* Round 2 */
63 { { { 0xa4, 0x9c, 0x7f, 0xf2, /* start */
64 0x68, 0x9f, 0x35, 0x2b,
65 0x6b, 0x5b, 0xea, 0x43,
66 0x02, 0x6a, 0x50, 0x49, } },
67
68 { { 0x49, 0xdb, 0x87, 0x3b, /* after shiftrows */
69 0x45, 0x39, 0x53, 0x89,
70 0x7f, 0x02, 0xd2, 0xf1,
71 0x77, 0xde, 0x96, 0x1a, } },
72
73 { { 0x58, 0x4d, 0xca, 0xf1, /* after mixcolumns */
74 0x1b, 0x4b, 0x5a, 0xac,
75 0xdb, 0xe7, 0xca, 0xa8,
76 0x1b, 0x6b, 0xb0, 0xe5, } },
77
78 { { 0xf2, 0xc2, 0x95, 0xf2, /* round key */
79 0x7a, 0x96, 0xb9, 0x43,
80 0x59, 0x35, 0x80, 0x7a,
81 0x73, 0x59, 0xf6, 0x7f, } } },
82
83 /* Round 3 */
84 { { { 0xaa, 0x8f, 0x5f, 0x03, /* start */
85 0x61, 0xdd, 0xe3, 0xef,
86 0x82, 0xd2, 0x4a, 0xd2,
87 0x68, 0x32, 0x46, 0x9a, } },
88
89 { { 0xac, 0xc1, 0xd6, 0xb8, /* after shiftrows */
90 0xef, 0xb5, 0x5a, 0x7b,
91 0x13, 0x23, 0xcf, 0xdf,
92 0x45, 0x73, 0x11, 0xb5, } },
93
94 { { 0x75, 0xec, 0x09, 0x93, /* after mixcolumns */
95 0x20, 0x0b, 0x63, 0x33,
96 0x53, 0xc0, 0xcf, 0x7c,
97 0xbb, 0x25, 0xd0, 0xdc, } },
98
99 { { 0x3d, 0x80, 0x47, 0x7d, /* round key */
100 0x47, 0x16, 0xfe, 0x3e,
101 0x1e, 0x23, 0x7e, 0x44,
102 0x6d, 0x7a, 0x88, 0x3b, } } },
103 };
104
105 static void verify_log(const char *prefix, const State *s)
106 {
107 printf("%s:", prefix);
108 for (int i = 0; i < sizeof(State); ++i) {
109 printf(" %02x", s->b[i]);
110 }
111 printf("\n");
112 }
113
114 static void verify(const State *ref, const State *tst, const char *which)
115 {
116 if (!memcmp(ref, tst, sizeof(State))) {
117 return;
118 }
119
120 printf("Mismatch on %s\n", which);
121 verify_log("ref", ref);
122 verify_log("tst", tst);
123 exit(EXIT_FAILURE);
124 }
125
126 int main()
127 {
128 int i, n = sizeof(rounds) / sizeof(Round);
129 State t;
130
131 for (i = 0; i < n; ++i) {
132 if (test_SB_SR(t.b, rounds[i].start.b)) {
133 verify(&rounds[i].after_sr, &t, "SB+SR");
134 }
135 }
136
137 for (i = 0; i < n; ++i) {
138 if (test_MC(t.b, rounds[i].after_sr.b)) {
139 verify(&rounds[i].after_mc, &t, "MC");
140 }
141 }
142
143 /* The kernel of Cipher(). */
144 for (i = 0; i < n - 1; ++i) {
145 if (test_SB_SR_MC_AK(t.b, rounds[i].start.b, rounds[i].round_key.b)) {
146 verify(&rounds[i + 1].start, &t, "SB+SR+MC+AK");
147 }
148 }
149
150 for (i = 0; i < n; ++i) {
151 if (test_ISB_ISR(t.b, rounds[i].after_sr.b)) {
152 verify(&rounds[i].start, &t, "ISB+ISR");
153 }
154 }
155
156 for (i = 0; i < n; ++i) {
157 if (test_IMC(t.b, rounds[i].after_mc.b)) {
158 verify(&rounds[i].after_sr, &t, "IMC");
159 }
160 }
161
162 /* The kernel of InvCipher(). */
163 for (i = n - 1; i > 0; --i) {
164 if (test_ISB_ISR_AK_IMC(t.b, rounds[i].after_sr.b,
165 rounds[i - 1].round_key.b)) {
166 verify(&rounds[i - 1].after_sr, &t, "ISB+ISR+AK+IMC");
167 }
168 }
169
170 /*
171 * The kernel of EqInvCipher().
172 * We must compute a different round key: apply InvMixColumns to
173 * the standard round key, per KeyExpansion vs KeyExpansionEIC.
174 */
175 for (i = 1; i < n; ++i) {
176 if (test_IMC(t.b, rounds[i - 1].round_key.b) &&
177 test_ISB_ISR_IMC_AK(t.b, rounds[i].after_sr.b, t.b)) {
178 verify(&rounds[i - 1].after_sr, &t, "ISB+ISR+IMC+AK");
179 }
180 }
181
182 return EXIT_SUCCESS;
183 }